X11 Forwarding (Display GUI)
Open graphical apps from a remote host as windows on this computer — per host, with a one-time cookie per session.
X11 Forwarding (Display GUI)
Run a graphical app on a remote Linux host — xclock, gedit, wireshark, virt-manager, a Java installer — and have its window open on your own computer. This is SSH's -X / -Y, saved per host.
What you need
- On this computer, an X server.
- macOS: XQuartz. If it's missing, a terminal tab with forwarding on offers a Download XQuartz button. After installing, press Start XQuartz in that tab (or in Settings) and open a new tab to the host. Alternatively, log out of macOS and back in once, after which XQuartz starts by itself whenever a remote app opens a window.
- Windows: nothing. Kubexer Terminal includes an X server (VcXsrv) that starts the first time a remote app opens a window and stops when you quit. Windows may ask once whether to let it through the firewall; you can decline, because forwarding only uses this computer. To use your own X server (VcXsrv, X410, Xming) instead, turn off Built-in X server in Settings → Terminal.
- Linux: any graphical session, including Wayland with XWayland.
- On the server,
X11Forwarding yesin/etc/ssh/sshd_config, and thexauthpackage installed.
Check the first half under Settings → Terminal → X11 forwarding → Test connection. The test does a real X11 handshake, so it confirms the server accepts connections as well as that it is listening.
Turn it on
Open a host → Display GUI (X11 forwarding) and pick a mode:
| Mode | What it does |
|---|---|
| Default | Uses the default from Settings (Off unless you change it). |
| Off | Never forward. |
| Auto | Forward when an X server is running here. Otherwise the host connects normally and nothing is shown. |
| Always | Always ask for forwarding. If it can't work, the terminal says why: no X server here, or the server refused. |
Then connect and run a GUI app. When forwarding is live the tab shows an X11 badge, and the number beside it is how many GUI apps are connected. Hover the badge for details, such as a warning that xauth is missing on the server.
A server that refuses X11 never costs you the shell: the connection simply carries on without it.
Security
Forwarding gives the server a path onto your desktop, so use it only with servers you trust.
- Your real X cookie never leaves this computer. Each session sends the server a random one-time cookie instead. Every incoming connection is checked against it before it reaches your display, so another user on a shared server can't use your forwarding.
- Sandbox remote apps (Settings → Terminal) gives remote apps an untrusted cookie, like
ssh -X. The X SECURITY extension then stops them from reading other windows, logging keystrokes or capturing the screen. A few apps misbehave under the sandbox, and it needsxauthon this computer.
Through jump hosts
Forwarding works through a jump chain unchanged. Only the final host's shell asks for it, and the hops just carry the bytes.
Troubleshooting
- "cannot open display" on the server: forwarding wasn't granted. Hover the badge, or set the host to Always to see the reason in the terminal.
- "Invalid MIT-MAGIC-COOKIE-1 key": install
xauthon the server (apt install xauth,dnf install xorg-x11-xauth). - An X server on another display or port: set DISPLAY in Settings, for example
localhost:1.